The post-shortage GLP-1 market is a spectrum: licensed pharmacies and legitimate telehealth on one end, “research peptide” storefronts on the other, and a gradient of ambiguity between. Every check below is something you can verify yourself, tonight, for free — the same checks our ledger verification runs on every provider, including our partner.
First, know what you’re checking
Most telehealth brands are not pharmacies — they’re platforms connecting you to prescribers, with dispensing done by partner pharmacies you may never have heard of. Legitimacy therefore has two layers: the platform’s clinical model, and the actual pharmacy’s license. A polished website tells you about the marketing budget; the checks below tell you about the medicine.
Check 1: a real prescription is required
U.S. law makes prescription-free sale of these drugs illegal, no exceptions. Any site offering GLP-1s without a prescriber evaluation — or with a “questionnaire” that approves everyone instantly for a fee — has disqualified itself in step one. A legitimate intake collects real medical history and can say no; screening that can’t reject anybody isn’t screening.
Check 2: the pharmacy’s state license, looked up by you
Ask which pharmacy will dispense your medication — name, city, state. Then verify the license yourself through that state board of pharmacy’s public lookup (every state runs one), confirming it’s active and licensed to ship into your state. A platform that won’t name its pharmacy before payment has answered your real question already.
Check 3: LegitScript and NABP signals
Two independent accreditation layers: LegitScript certification (searchable on their public site) and NABP’s programs, including the .pharmacy domain registry and their “not recommended” list — worth searching in both directions. Absence of certification isn’t proof of fraud (accreditation costs money and some legitimate operations skip it), but presence is meaningful, and appearing on a warning list is dispositive.
Check 4: 503A/503B honesty, for compounded product
Compounded GLP-1s come from either a state-licensed 503A pharmacy (patient-specific compounding) or an FDA-registered 503B outsourcing facility (batch production under federal manufacturing standards). A legitimate program tells you which, unprompted, and can explain its post-shortage legal rationale — the contested landscape our legal-status file maps. Evasion on this question, or the phrase “FDA-approved compounded semaglutide” (an oxymoron — compounded drugs are not FDA-approved), are bright red flags.
Check 5: testing you can actually see
Ask for the certificate of analysis (COA) for your product’s batch: identity, potency, sterility, endotoxin testing from a named laboratory. A COA isn’t a guarantee — our gray-market file covers forged and recycled ones — but the response to the request is itself diagnostic: legitimate operations produce documents; illegitimate ones produce indignation. Cross-check that the lab named actually exists.
Check 6: a real-world footprint
A physical U.S. address that maps to something real; a phone line where a human — ideally a pharmacist — answers medication questions; named clinical leadership; functioning complaint handling. Anonymity is cheap online, which is exactly why its absence signals somebody accountable exists. Domain-age and contact-page archaeology take five minutes and regularly unmask storefronts younger than their “10,000 happy patients.”
Check 7: payment normalcy
Licensed operations take ordinary cards, issue receipts suitable for HSA/FSA use, and state refund terms in writing. Crypto-only, wire-only, Zelle-to-a-person, or gift-card payment exists to defeat chargebacks and vanish cleanly — in a medication context it’s functionally a confession. Similarly, teaser structures that hide the real recurring price until after card entry are a transparency failure our teaser-anatomy file dissects.
Check 8: the language test
“Research use only” and “not for human consumption” on a consumer site mean the seller is disclaiming the exact use they’re selling — memorize that translation. Other tells: pipeline molecules for sale (retatrutide, orforglipron — counterfeit by definition, see the medication files), miracle language with no side-effect information, countdown timers on medical decisions, and testimonials doing the work evidence should.
If you’ve already been burned
Report it — reports are how enforcement finds targets: FDA’s BeSafeRx and MedWatch programs for suspect online sellers and adverse events, your state board of pharmacy for licensing violations, the FTC for deceptive practices, and your card issuer for chargebacks. If you injected a suspect product and feel unwell, that’s a medical call first and a report second.
The bottom line
Eight checks, none requiring expertise: prescription required, license verified, accreditation searched, compounding lane disclosed, COA produced, footprint real, payment normal, language clean. Any single hard failure — no prescription, unverifiable license, research-only fine print, crypto-only checkout — ends the evaluation. The legitimate market has real problems, teaser pricing chief among them; the illegitimate market has your money and no obligations at all.
A fifteen-minute walkthrough, start to finish
Run it on a hypothetical “SlimRx Direct” advertising $99 semaglutide. Minute one: the site offers approval “in minutes” via questionnaire — pause, but questionnaires can be legitimate intake fronts, so continue. Minutes two through five: support chat asked which pharmacy dispenses; the answer, “our trusted U.S. partner network,” names nothing — first hard strike. Minutes six through nine: LegitScript search returns nothing; NABP’s lists return nothing either way; the domain registered eight months ago despite “serving patients since 2019” — second strike. Minute ten: the terms page reveals the $99 covers month one at the starter dose, with maintenance “from $299” plus a $49 monthly “provider access” fee — the teaser anatomy in the wild. Minutes eleven through thirteen: the COA request produces a two-year-old PDF for a different product from a lab whose website is a template — third strike. Minute fourteen: checkout accepts cards but pushes a 12% “crypto discount.” Minute fifteen: close the tab. Total cost of the investigation: nothing. Total cost of skipping it: read the next section.
What legitimacy does and doesn’t guarantee
Passing all eight checks means the medication is real, the pharmacy is accountable, and recourse exists — it does not mean the price is fair, the care is good, or the pricing structure is honest. Fully licensed operations run teaser funnels; accredited pharmacies dispense for platforms with checkout-grade clinical screening. That’s why our rubric scores legitimacy as the floor, then grades transparency, care model, and true cost above it — and why the platform-quality criteria are a separate page from this one. Verification gets you a real pharmacy; judgment gets you a good program.
Mini-FAQ
What about Canadian or overseas pharmacies? Personal importation of prescription drugs into the U.S. is, with narrow exceptions, not legal, and enforcement aside, you inherit another country’s supply chain with none of your own recourse — for injectables in a category flooded with counterfeits, the risk calculus fails even where the storefront is genuine. Are group buys from peptide forums safer because the community “tests” batches? No — crowd-sourced testing of gray-market vials is the gray market with extra steps, and the sterility risks injection adds are exactly what forum COA screenshots can’t address. Do COAs expire? Functionally yes: a COA speaks for one batch at one test date. A current product with an old certificate is an unanswered question. Is a telehealth brand “FDA-approved”? No platform is; drugs get approved, facilities get registered, pharmacies get licensed. A brand claiming FDA approval of itself is confused at best. My employer’s program uses a pharmacy I’ve never heard of — red flag? Not inherently; PBM and employer channels route through legitimate mail-order pharmacies constantly. Run check two — the license lookup — and let the answer, not the unfamiliarity, decide.
The reporting muscle, exercised
One habit worth building even when you weren’t burned: when a site fails hard — no-prescription sales, pipeline molecules for sale — spend ninety seconds filing the FDA online-seller report anyway. Enforcement runs on reports; the person you protect is whoever would have clicked next. Our corrections channel also takes tips on any provider in our queue, partner included.
The two-list method
Distill the eight checks into two pocket lists. Deal-makers — all required before payment: a prescriber who can say no; a named dispensing pharmacy whose state license you looked up yourself; a stated 503A or 503B lane for compounded product; a batch COA from a findable laboratory; ordinary card payment with written refund and cancellation terms; a human-answered phone line. Deal-breakers — any single one ends it: no prescription required; “research use only” or “not for human consumption” anywhere; pipeline molecules for sale; crypto-, wire-, or gift-card-preferred checkout; a pharmacy the platform won’t name; appearance on NABP’s not-recommended list. Screenshot both lists into your phone. The gray market’s entire business model is catching people without a checklist at 11 p.m. with a coupon expiring at midnight; the two-list method costs the impulse purchase its oxygen, which is exactly the point.
Sources
FDA BeSafeRx consumer guidance; NABP accreditation and not-recommended-site programs; LegitScript certification standards; FDCA prescription-drug provisions; 503A/503B statutory framework — primary links collected at sources.